Privacy policy

We are glad you are visiting our online shop. Protecting your personal data matters to us. Below you will find which data we collect, what we use it for and which rights you have.

1. Controller

The controller for data processing on madluxx.com is:

Madluxx GmbH
Kaffeestrasse 8d
8180 Bülach
Switzerland
UID: CHE-413.382.173
Email: info@madluxx.com

For questions about data protection or to exercise your rights, contact us at info@madluxx.com. We have not appointed a data protection officer, as the legal requirements for doing so do not apply to us.

2. Scope

We deliver to Germany, Austria, France and Switzerland. For customers resident in the European Union, the General Data Protection Regulation (GDPR) applies; for customers in Switzerland, the Swiss Federal Act on Data Protection (revFADP) applies. Where we refer to articles of the GDPR below, the principles described apply accordingly under Swiss law.

3. Visiting our website

If you only browse our pages without registering or sending us data, we collect the information your browser transmits automatically and that is technically necessary to display the page and keep the shop secure and stable:

IP address
date and time of the request
page requested and volume of data transferred
referring website from which you reached us
browser, operating system and language setting

The legal basis is our legitimate interest in a secure and functioning shop (Art. 6(1)(f) GDPR). This data is not combined with other data and is deleted after a short period.

4. Shop platform Shopify

Our shop runs on the Shopify platform. The provider is Shopify Inc., Ottawa, Canada, together with its affiliated companies, including Shopify International Ltd. based in Dublin, Ireland. Shopify processes the data as our processor, meaning on our instructions and on the basis of a data processing agreement.

Data from Europe is first processed in Ireland and may then be transferred to Canada and the United States. Canada is covered by an adequacy decision of the European Commission. For transfers to the United States, Shopify relies on standard contractual clauses and the EU-US Data Privacy Framework. More information: shopify.com/legal/privacy

5. Orders and contract processing

To process an order we need your first and last name, delivery and billing address, email address and the details of the payment method you choose. We use this data to process your order, keep you informed about its status and fulfil our contractual obligations.

The legal basis is performance of the purchase contract (Art. 6(1)(b) GDPR) and, for storing invoices, our legal obligations (Art. 6(1)(c) GDPR). Purchase records are kept for up to ten years in line with commercial and tax retention periods.

6. Payment

Depending on the payment method you choose, we pass on the data required for processing to the relevant payment provider. We do not record your full payment details, such as card numbers; you enter them directly with the payment provider.

Credit and debit cards via Shopify Payments (Shopify Inc. and affiliated companies)
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland
Google Pay: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Shop Pay: Shopify Inc. and affiliated companies

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). For credit and fraud checks, the payment providers additionally pursue their own legitimate interests (Art. 6(1)(f) GDPR). The privacy information of the respective provider applies in addition.

7. Shipping

For delivery we pass your name, delivery address and, if you provide them, your email address or telephone number to our shipping partners: DHL Express for deliveries within the EU and Swiss Post for deliveries within Switzerland. For shipments to the EU we also transmit the details required for the customs declaration.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for customs data, compliance with legal obligations (Art. 6(1)(c) GDPR).

8. Customer account

You can order as a guest or create a customer account. In your account we store your basic details and your order history so that you can view them and complete future orders more quickly. The legal basis is performance of the contract or your consent (Art. 6(1)(b) and (a) GDPR). You can have your account deleted at any time; statutory retention obligations for orders already processed remain unaffected.

9. Contacting us

If you write to us via the contact form or by email, we use your details solely to handle your request. The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, for enquiries relating to an order or the conclusion of a contract, Art. 6(1)(b) GDPR. We delete enquiries once they have been dealt with and no retention obligations apply.

10. Newsletter

With your consent we inform you by newsletter about new pieces, offers and events. The only mandatory detail is your email address.

We use the double opt-in procedure: after signing up you receive an email asking you to confirm your registration. If you do not confirm within 24 hours, we block the data and delete it automatically after one month at the latest. We also store the time of registration and confirmation as well as the IP address used, so that we can prove the registration.

Our newsletters contain small tracking pixels that allow us to see whether an email has been opened and which links have been clicked. This analysis helps us tailor content to your interests. It also takes place only with your consent and is not carried out if your email programme blocks images by default.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, via the unsubscribe link in every email or informally at info@madluxx.com.

For sending we use Klaviyo Inc., 225 Franklin Street, Floor 10, Boston, MA 02110, USA, as our processor. Klaviyo also processes data in the United States and relies on standard contractual clauses under Art. 46 GDPR as well as the EU-US Data Privacy Framework. More information: klaviyo.com/legal/privacy/privacy-notice

11. Product reviews

After a purchase we invite you by email to leave a review. For this we use the service Judge.me as our processor. Your name, email address and order details are processed. Your review is published with the name you provide yourself.

The legal basis for the review invitation is our legitimate interest in feedback on purchased products (Art. 6(1)(f) GDPR); publication is based on your consent (Art. 6(1)(a) GDPR). You can object to the review invitation at any time, via the unsubscribe link in the email or by message to info@madluxx.com.

12. Withdrawal form

For declaring a withdrawal online we use the service Revoq. The details you enter in the form are processed, in particular order number, name, email address and the reason for the return. We use this data to process your withdrawal and confirm its receipt. The legal basis is performance of the contract and compliance with our legal obligations (Art. 6(1)(b) and (c) GDPR).

13. Estimated delivery date

On product and cart pages an app displays an estimated delivery date. The display is calculated from predefined rules. No analysis of your behaviour takes place.

14. Cookies and consent

We use cookies and comparable technologies. Necessary cookies keep the shop working, for example for the cart, the login and the language setting. They are required for us to provide the service (Art. 6(1)(f) GDPR).

All other cookies, in particular for marketing and statistics, are only set with your consent (Art. 6(1)(a) GDPR). Our cookie banner appears for this purpose on your first visit. You can change or withdraw your choice at any time by opening the cookie settings in the shop again. Independently of this, you can delete or block cookies in your browser; some functions may then be unavailable.

15. Meta pixel and Custom Audiences

With your consent we use the Meta pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It allows us to understand which actions you take after clicking one of our ads, for example viewing or buying a product, and to show you relevant ads on Facebook and Instagram.

For the collection and transmission of data via the pixel we are joint controllers with Meta (Art. 26 GDPR). In an agreement, Meta has assumed the essential obligations, in particular informing data subjects and safeguarding their rights; details can be found at facebook.com/legal/controller_addendum. Any further processing is carried out by Meta under its own responsibility in accordance with its privacy policy: facebook.com/privacy/policy

Data may be transferred to the United States. Meta relies on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via our cookie settings. You can also deactivate personalised advertising directly in your Meta account settings.

16. Google Ads and conversion tracking

With your consent we use services from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Conversion tracking lets us measure whether a purchase or another desired action follows a click on one of our ads. We receive aggregated reports and cannot identify you personally.

The legal basis is your consent (Art. 6(1)(a) GDPR). Data may be transferred to the United States; Google relies on the EU-US Data Privacy Framework and standard contractual clauses. You can withdraw your consent at any time via the cookie settings. More information: policies.google.com/privacy

17. Google Analytics 4

If you consent, we use Google Analytics 4 from Google Ireland Ltd. to analyse how our shop is used and to improve it continuously. Analytics uses cookies and similar identifiers and records, for example, the pages viewed, time spent, approximate location based on the shortened IP address as well as device and browser. The IP address is shortened by Google and not stored permanently.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the cookie settings. You can also prevent collection using Google’s browser add-on: tools.google.com/dlpage/gaoptout. Data may be transferred to the United States; the EU-US Data Privacy Framework and standard contractual clauses apply.

18. Social media profiles

Our shop links to our profiles on Instagram, Facebook and YouTube. These are simple links. Data is only transmitted to the respective provider when you click a link; if you are logged in there, the provider can associate the visit with your account. The providers are solely responsible for processing on those platforms. Their privacy information applies.

19. Recipients of your data

Only those parties receive your data who need it for processing: our platform and IT providers, payment providers, shipping partners, the newsletter and review services as well as, to the extent required by law, authorities, tax advisors and auditors. All processors are contractually obliged to process your data exclusively on our instructions. We do not sell data.

20. Transfers to third countries

Some of the services mentioned process data outside the EU and Switzerland, in particular in the United States and Canada. Canada is covered by an adequacy decision. For the United States we rely on the EU-US Data Privacy Framework, in which the providers used participate, and additionally on the European Commission’s standard contractual clauses. Despite these measures, access to data by US authorities cannot be entirely ruled out.

21. Retention periods

We store your data for as long as it is needed for the respective purpose:

order and invoice data: up to ten years due to commercial and tax retention obligations
customer account: until the account is deleted
newsletter: until you withdraw your consent
contact enquiries: until they are dealt with, then at most until possible limitation periods expire
consents and cookie choices: for the duration of the statutory obligation to provide evidence

22. Your rights

You have the right to access the data we hold about you, to rectification of inaccurate data, to erasure, to restriction of processing and to data portability. You can withdraw consents you have given at any time with effect for the future.

Right to object: you can object at any time to processing that we base on a legitimate interest (Art. 21 GDPR). If your objection concerns direct marketing, we will stop the processing for that purpose in every case; no reasons are required.

A message to info@madluxx.com is enough for any request.

You can also lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern. In the EU you can contact the supervisory authority of your country of residence.

23. No automated decision-making

No automated decision-making or profiling with legal effect for you takes place.

24. Data security

We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Transmission in the shop is encrypted via TLS; you can recognise this by the padlock symbol and the prefix “https://” in your browser’s address bar. Please note that data sent by ordinary email is not encrypted.

25. Changes to this notice

We update this privacy notice when our services or the legal requirements change. The version published here applies.

Version: September 2026